# CVE-2018-6389

In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.

- Page: https://www.vulneraibility.com/cve/CVE-2018-6389
- CVSS: 7.5
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 72.67% (percentile 99.5)
- Public exploit code: 1 on Exploit-DB · 22 GitHub proofs of concept (first 2018-02-05)
- Published: 2018-02-06

## Affected

- wordpress:wordpress

## References

- [other] http://www.securityfocus.com/bid/103060
- [other] https://wpvulndb.com/vulnerabilities/9021
- [exploit] https://www.exploit-db.com/exploits/43968/
- [other] https://baraktawily.blogspot.fr/2018/02/how-to-dos-29-of-world-wide-websites.html
- [other] http://www.securitytracker.com/id/1040347
- [other] https://thehackernews.com/2018/02/wordpress-dos-exploit.html
- [other] https://github.com/WazeHell/CVE-2018-6389
- [other] https://github.com/UltimateHackers/Shiva

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.